Use go-toolkit component

Update our configuration to use the go toolkit component in replacement of the TBC golang & operator template.

This require an adaptation of the existing makefile to fit in the new logic of the CI component see below.

Clean now deprecated renovate config

This component is not just a conversion from GitLab CI templates to components; it also changes the existing logic. The previous templates relied on custom images for each job, which made them difficult to maintain because project and tooling versions could drift apart. They also did not ensure that the Makefile targets actually worked.

The new component uses the provided Makefile as the entry point for most jobs instead of relying on custom images. In return, the consuming project must define a tools/ directory listing the required dependencies. This keeps the tooling versions aligned with the Go version used by the project.

Old job	Source	New job (go-toolkit, prefix <as>)	Notes
ensure-manifests-are-generated	ci-templates/operator-template.yml	<as>-generate	Same pattern: run make manifests generate then git diff --quiet.
test-operator	ci-templates/operator-template.yml	<as>-test	Same JUnit + Cobertura publishing; report tools installed from consumer's tools/go.mod instead of @latest.
test-operator-e2e	ci-templates/operator-template.yml	<as>-e2e	Opt-in via e2e-enabled: true. Docker CLI now installed as a static binary pinned to docker-version.
test-operator-kube-api-linter	ci-templates/operator-template.yml	<as>-kube-api-linter	Opt-in via kube-api-linter-enabled: true. File-change rules dropped (component doesn't hardcode project paths).
deploy-operator	ci-templates/operator-template.yml	—	Not replaced. Operator-specific kind-cluster deploy step; belongs elsewhere.
go-ci-lint	to-be-continuous/golang	<as>-lint	Now delegates to make lint. Consumer controls the exact command in the Makefile.
go-build-test	to-be-continuous/golang	<as>-build + <as>-test	Split into two jobs running in parallel after <as>-lint.
go-govulncheck	to-be-continuous/golang	<as>-govulncheck	Text output as artifact. Exit code 3 (vulns found) tolerated so job stays green. GitLab report integration dropped — govulncheck's schemas aren't accepted by sast.
go-sbom	to-be-continuous/golang	<as>-sbom	CycloneDX via cyclonedx-gomod, published as reports.cyclonedx (surfaces in GitLab Dependency List).
go-semgrep	to-be-continuous/golang	<as>-semgrep	Now uses semgrep ci --config=auto (CI-aware, diff-only on MR pipelines), publishes GitLab-native SAST report.
go-outdated	to-be-continuous/golang	—	Not replaced (follow-up).
go-fmt, go-vet	to-be-continuous/golang	folded into <as>-lint	Standard operator Makefiles chain fmt vet into lint.

Worth to note, I've changed the go vulncheck job so It will never failed (except a failure in command itself) as we are using it more as an informative job; We never block MRs for that.

deploy-operator job was dropped, as we now have e2e testing that replaced it. It also avoid to maintain a custom image (which was never well aligned with what we are doing in sylva-core) go mod outdated job was dropped, previously it was a manual job and I don't think we have people running it (can be added later, if required)

---

go-toolkit component: sylva-projects/sylva-elements/ci-tooling/ci-components/go-toolkit!1 (merged) part of sylva-projects/sylva-elements/ci-tooling/ci-components/go-toolkit#1 (closed)